CVE-2026-35349

CVE-2026-35349 is a vulnerability in the rm utility of uutils coreutils that allows attackers to bypass the --preserve-root protection mechanism, which is designed to prevent accidental deletion of the root filesystem. The flaw stems from improper root directory identification, relying on string-based path comparison rather than device and inode number verification. An attacker can exploit this by creating a symbolic link pointing to the root directory and leveraging it with rm, potentially causing unintended recursive deletion of the entire root filesystem. The vulnerability presents medium severity with a CVSS score of 6.7, requiring local access but no special privileges or user interaction. The attack has high impact potential, affecting both system integrity and availability through filesystem destruction, though confidentiality is not compromised. The local attack vector and higher complexity requirements provide some friction to exploitation. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.000140000 indicates minimal probability of exploitation compared to other disclosed vulnerabilities. Community attention remains low, and no public exploit code has been widely circulated, suggesting this remains primarily a theoretical risk at this time.